CVE-2023-47870 WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)
Attackers can force all users to log out via CSRF due to missing authorization checks in the wpForo Forum plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-47870?
CVE-2023-47870 is a high-severity vulnerability in gVectors Team wpForo Forum, published on 30 Nov 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a through 2.2.6.
Which versions are affected by CVE-2023-47870?
It affects 1 product.
Products include Gvectors Wpforo Forum.
How do I fix CVE-2023-47870?
No fix has been published for CVE-2023-47870 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-47870 being exploited?
There is no known exploitation of CVE-2023-47870 in the wild and no public exploit code.
Other vulnerabilities in gVectors Team wpForo Forum
- CVE-2024-3200 wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
- CVE-2022-40200 WordPress wpForo Forum plugin <= 2.0.9 - Auth. Arbitrary File Upload vulnerability
- CVE-2018-16613 Privilege escalation in n/a
- CVE-2026-28562 wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter
- CVE-2023-2249 Server-side request forgery in wpForo Forum
Sources
Also known as GHSA-whr2-w3q9-5g6m.